CMMC compliance for DoD manufacturers

The Cybersecurity Maturity Model Certification (CMMC) is a Department of Defense (DoD) program that outlines the cybersecurity standards and best practices required for government contractors. CMMC compliance for manufacturers in the DoD supply chain involves meeting specific cybersecurity standards and best practices

CMMC introduces stronger accountability for the prime contractor. Prior to being awarded a contract, a prime contractor must validate appropriate levels of compliance for themselves and subcontractors to reinforce security across the entire supply chain.

Under the CMMC program, Defense Industrial Base (DIB) contractors are required to implement specific cybersecurity protection standards, perform self-assessments, and obtain third-party certification as a condition of DoD contract award. For more information, please visit DoD CMMS website.

Many DIB subcontractors are now urgently trying to reach required CMMC level certification. The DoD announced CMMC 2.0 in November of 2021 as DIB contractors have to achieve CMMC certifications. One of the faster ways to achieve varying levels of certification is to have the ERP system on AWS GovCloud or Azure Government Cloud. However, those deployments will only get you around twenty percent of the way toward full Level 3 CMMS compliancy.

FedRAMP authorized cloud-based ERP

CMMC is intended to assess a DIB contractor’s implementation of certain levels of cybersecurity processes and practices. A DIB contractor who uses a cloud-based ERP application needs to ensure that the ERP application has at least a FedRAMP (Federal Risk and Authorization Program) Moderate authorization. There are only a few ERP applications in the small to medium-sized business (SMB) space that are FedRAMP authorized.

Infor’s CloudSuite Industrial/SyteLine ERP was FedRAMP authorized in 2018 through the Joint Authorization Board (JAB) in alignment with Infor Government Solutions. All FedRamp authorized applications can be found on the FedRAMP Marketplace. CMMC compliancy for manufacturers is much more difficult if they are using an ERP system that is not listed on the FedRAMP marketplace. This is important to think about if you’re considering switching to a new system.

Download: How to Select ERP...and not regret it

FedRAMP Authorized Infor Cloud ERP Applications include:

• Infor CloudSuite Industrial/SyteLine
• Infor Factory Track
• Infor OS
• Infor Campus

Infor’s FedRAMP strategy allows Infor to support data security and privacy requirements for many regulated industries, including those requiring compliance with:

• International Organization for Standardization (ISO)-27001
• Federal Information Processing Standards (FIPS) 140-2
• Transport Layer Security (TLS) 1.2
• National Institute of Standards and Technology (NIST) 800-88, NIST 800-53 / 800-171
• International Traffic in Arms Regulations (ITAR)
• Export Administration Regulation (EAR)
• Defense Federal Acquisition Regulation Supplement (DFARS)

Achieving FedRAMP authorization for ERP requires extensive testing by Infor with its team of security consultants, an independent third-party audit organization (3PAO), as well as the U.S. government. Infor has achieved FedRAMP authorization, and an Authority to Operate (ATO) by the JAB. The JAB is comprised of CIOs from the following federal organizations: General Services Administration (GSA), DoD, and Department of Homeland Security (DHS).

Infor government solutions

To help determine if Infor Government Solutions (IGS) and Infor CloudSuite Industrial/SyteLine ERP can meet your manufacturing business’s needs for CMMC compliance, please review the diagram below:

If you answered yes to many of the questions in the diagram, then you are a prime candidate for IGS and Visual South.

 Infor puts significant effort into addressing the requirements for manufacturers needing to meet CMMC compliancy levels as part of the DIB supply chain. If you are evaluating the ability of a cloud-based manufacturing ERP system to assist towards the goal of CMMC compliance, then please note the benefits of partnering with Infor for regulated industries.

•  Infor Government Solutions (IGS) is hosted in an isolated government-only region of AWS GovCloud (US).
• AWS GovCloud adheres to:
  • U.S. International Traffic in Arms Regulations (ITAR)
  • Federal Risk and Authorization Management Program (FedRAMP)
  • Criminal Justice Information Services (CJIS) requirements
  • Department of Defense (DoD) Cloud Computing Security Requirements Guide (SRG) Impact Levels 2, 4, and 5. IGS offerings are categorized using NIST SP 800-53 and the FedRAMP baseline to withstand a Moderate impact level.
• In addition to the FedRAMP Joint Authorization Board (JAB) authorization, IGS is also compliant for Health Insurance Portability and Accountability Act of 1996 (HIPAA) and NIST SP 800-171, rev 1, Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations.

Additional Benefits:

• Aerospace & Defense is a focus industry for Infor, and Infor is committed to maintaining compliance with applicable Federal regulations in Infor Government Solutions (IGS).
• Federal contractors can meet FAR 52.204-21 and DFARS 252.204-7012 cybersecurity requirements when using Infor Government Solutions (IGS) Subscription Services in accordance with IGS terms and conditions, including the Customer Responsibilities Matrix and External Rules of Behavior.
• IGS solutions for A&D supports business processes that are compliant with the DCAA Cost Accounting Standards (CAS compliant) and the DCMA Material Management and Accounting System (MMAS) Review.

Related: Aerospace & Defense ERP Software:  10 Unique Features You Need

Related: ERP for Manufacturers in the Aerospace Industry

Summary

Infor offers a unique combination of a world-class manufacturing ERP solution with Infor CloudSuite Industrial. Infor’s project-specific manufacturing is ranked in the Leader’s Quadrant by renowned independent analyst organizations, including Gartner, IDC, and Nucleus Research. With the strength of Infor ERP and benefits from Infor Government Solutions, plus the ERP deployment on AWS GovCloud, you have the infrastructure to address your manufacturing business requirements and CMMC compliance as required by the DoD.

For more information about how Visual South and Infor ERP can help manufacturers meet CMMC compliancy as well as standard operational needs, please reach out to schedule a free assessment.

For additional information on how we can help, please visit www.visualsouth.com.